Times Car Data Breach: Lessons for Japan’s Data Retention Culture and Risk Management

1. Introduction — The “Over‑Retention” Problem Exposed by Times Car

The Times Car data breach revealed that driver’s license images and identity documents had been stored for years, long after the verification process was completed. This was not merely a case of unauthorized access—it was a symptom of a deeper cultural issue: Japan’s corporate tendency to treat information as an asset rather than a risk.

The longer sensitive data is retained, the greater the potential damage when a breach occurs. In this case, data retention itself amplified the risk.

2. Japan’s Corporate Culture: Information as an Asset

Japanese companies often view data as a valuable resource for future use—marketing, analytics, or customer retention. This mindset leads to several behaviors:

• Prioritizing data retention over deletion
• Maintaining departmental silos that hoard information
• Applying the “mottainai” (waste‑not) mentality even to data
• Reinforcing the habit through past success stories of data‑driven campaigns

As a result, data accumulates faster than it can be managed, creating a structural vulnerability that magnifies the impact of breaches like Times Car’s.

3. The Western Contrast: Data as a Risk, Not an Asset

In contrast, Western companies—especially under GDPR—operate on the principle that data is both an asset and a liability. Their management culture emphasizes:

• Data minimization — collect only what is necessary
• Retention policies — define clear time limits
• Automated deletion systems
• Prohibition of secondary use
• Transparency in deletion processes

In short, Western firms focus less on “collecting power” and more on “responsible deletion.” This cultural difference directly affects the scale of damage when breaches occur.

4. Structural Weaknesses in Japan’s Data Retention Practices

The Times Car case highlights several recurring issues in Japanese corporate data management:

• Excessively long retention periods
• Manual, inconsistent deletion processes
• Overextended access privileges
• Weak oversight of third‑party vendors
• Neglected legacy data
• Vague or missing retention clauses in user agreements

These weaknesses create attack surfaces that hackers can exploit.

5. How Japanese Companies Should Transform Their Data Retention Practices

1. Define Clear Retention Periods

• Delete identity documents immediately after verification
• Remove inactive user data after a fixed period
• Specify retention duration in privacy policies

2. Implement Automated Deletion

Manual deletion inevitably leaves gaps. Automation ensures consistency and compliance.

3. Limit Retention Purpose

• Eliminate vague justifications like “it might be useful later”
• Restrict data use strictly to its original purpose

4. Standardize Vendor Data Management

• Require subcontractors to follow identical retention and deletion rules
• Include deletion obligations in contracts

5. Enforce Deletion Logs and Audits

• Keep records of deleted data
• Conduct annual audits to verify retention compliance

6. Modern Breaches Are Caused by Retention Negligence, Not Just Attacks

In today’s environment, many breaches stem not from sophisticated hacking but from excessive data retention:

• Data kept too long
• Poor management visibility
• Expanding internal access rights
• Uncontrolled vendor storage
• Forgotten legacy systems

The cultural belief that “data equals value” has become a liability. Retention negligence is now one of the most common root causes of corporate data exposure.

7. Conclusion — From a Culture of Collection to a Culture of Deletion

The Times Car incident is a wake‑up call for Japan’s corporate world. It demonstrates that data retention practices must evolve from accumulation to accountability.

To prevent future breaches, companies must:

• Abandon the “save everything” mindset
• Recognize data as both an asset and a risk
• Treat deletion as a strategic act of trust
• Elevate data retention to a board‑level responsibility

Only by shifting from a culture of collection to a culture of deletion can Japanese companies truly protect their users—and themselves—from the next inevitable breach.